The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.
IP (Internet Protocol) Flow Information eXport (IPFIX) is a protocol based on Cisco NetFlow version 9, which is defined in the Internet Engineering Task Force (IETF) Request for Comment (RFC) 3954. IPFIX is currently at the final phase of standardization at the IETF. IPFIX could be considered as NetFlow version 10. The Working Group home page is accessible at: http://www.ietf.org/html.charters/ipfix-charter.html.
The IPFIX protocol defines how IP Flow information can be exported from routers, measurement probes or other devices. IP Flow information can be used as input to various applications. IPFIX is a general data transport protocol, easily extensible to suit the needs of different applications. IPFIX provides appropriate Information Elements (IEs) for various IP versions. A text-based draft of the IPFIX Information Element draft is accessible at (http://www.ietf.org/internet-drafts/draft-ietf-ipfix-info-13.txt).
Information Elements of the IPFIX information model are grouped into 12 groups according to their characteristic semantics and their applicability. These groups are listed in Table 1, below.
TABLE 1GROUP NO.SEMANTICS/APPLICABILITY1Identifiers2Metering and Exporting Process Configuration3Metering and Exporting Process Statistics4IP Header Fields5Transport Header Fields6Sub-IP Header Fields7Derived Packet Properties8Min/Max Flow Properties9Flow Time Stamps10Per-Flow Counters11Miscellaneous Flow Properties12Padding
Information Elements that are derived from fields of packets or from packet treatment, such as the Information Elements in groups 4-7 of Table 1, may function as Flow Keys used for mapping packets to Flows. For Information Elements that are not functional as Flow Keys, values associated therewith may change from packet to packet, within a single Flow. For Information Elements with values that are derived from fields of packets or from packet treatment and for which the value may change from packet to packet within a single Flow, the IPFIX information model defines their value as determined by the first packet observed for the corresponding Flow, unless the description of the Information Element (IE) explicitly specifies a different semantics. This attribute allows writing all Information Elements (IEs) related to header fields once when the first packet of the Flow is observed. For further observed packets of the same Flow, Flow properties that depend on more than one packet, such as the Information Elements in groups 8-11, are updated. Information Elements with a name having the “post” prefix, for example, “postClassOfServiceIPv4”, report properties that are retrieved by various means within an Observation Domain, instead of properties that are observed at the Observation Point. These information Elements are usable where “middlebox” functions within the Observation Domain change Flow properties after packets passed the Observation Point.
By its design, IPFIX may export many different information elements, not just flow related ones. Several protocols have shown interest in using IPFIX. For example, the Packet Sampling protocol (PSAMP: http://www.ietf.org/html.charters/psamp-charter.html) uses IPFIX for the export of packet related information elements. The IP Performance Metrics Working Group (IPPM: http://www.ietf.org/html.charters/ippm-charter.html) proposed a way to export IP Service Level Agreement (SLA) metrics with IPFIX. The Next Steps in Signaling Working Group (NSIS: http://www.ietf.org/html.charters/nsis-charter.html) also investigated IPFIX as an export protocol.